Download Google Cloud Professional Cloud Security Engineer Ultimate Exam and more Exams Technology in PDF only on Docsity!
Security Engineer Ultimate Exam
Question 1. Which Google Cloud service synchronizes on-premises Active Directory objects to Cloud Identity? A) Cloud Identity-Aware Proxy B) Google Cloud Directory Sync (GCDS) C) Cloud Identity Groups API D) Cloud Identity Domains Answer: B Explanation: GCDS pulls users, groups, and contacts from AD/LDAP into Cloud Identity, keeping the two directories in sync. Question 2. When configuring SAML 2.0 SSO for Google Cloud Console, which attribute is most commonly used to map the external user’s email address to a Google account? A) NameID B) AttributeStatement C) SubjectConfirmation D) Audience Answer: A Explanation: The SAML NameID (often formatted as an email address) is used by Google to identify the federated user. Question 3. Which of the following is the recommended method to protect a privileged super-administrator account in Cloud Identity? A) Enforce a password change every 30 days B) Enable 2-step verification (2SV) with hardware security keys
Security Engineer Ultimate Exam
C) Assign the role “Viewer” instead of “Owner” D) Disable the account when not in use Answer: B Explanation: Using 2SV with hardware security keys provides strong, phishing-resistant protection for privileged accounts. Question 4. A company wants to allow its developers to log in to Google Cloud using Azure AD credentials. Which feature should they enable? A) Workforce Identity Federation B) Identity-Aware Proxy C) Cloud Identity Premium D) Service Account Impersonation Answer: A Explanation: Workforce Identity Federation lets external IdPs like Azure AD authenticate users to Google Cloud without creating separate Google accounts. Question 5. Which practice reduces the risk associated with default “Editor” roles on Google-provided service accounts? A) Grant the role only at the organization level B) Delete the default service account and create a new one with no roles C) Replace the default service account with a custom service account that has only required permissions D) Enable “Service Account Key Creation” for all users Answer: C
Security Engineer Ultimate Exam
A) Organization B) Folder C) Project D) Billing Account Answer: B Explanation: Folders inherit policies from the organization and can define additional restrictions or overrides for the projects they contain. Question 9. Which IAM role type can be defined by a customer to grant only the specific permissions needed for a custom application? A) Primitive role B) Predefined role C) Custom role D) Service-account role Answer: C Explanation: Custom roles let you specify an exact set of permissions, supporting the principle of least privilege. Question 10. An administrator wants to deny all access to a storage bucket from a specific IP range, regardless of other IAM permissions. Which feature should be used? A) IAM Conditions B) Deny Policy C) Organization Policy Constraint D) VPC Service Controls
Security Engineer Ultimate Exam
Answer: B Explanation: Deny policies explicitly block access based on conditions (e.g., source IP), overriding any allow permissions. Question 11. Which tool provides automated suggestions to reduce over-privileged permissions in IAM policies? A) IAM Policy Analyzer B) IAM Recommender C) Cloud Asset Inventory D) Policy Troubleshooter Answer: B Explanation: IAM Recommender analyzes usage patterns and suggests removal of unused or excessive permissions. Question 12. Access Context Manager is primarily used to create what type of security control? A) Network firewall rules B) Attribute-based access levels for BeyondCorp C) Service account key rotation policies D) Encryption key rotation schedules Answer: B Explanation: Access Context Manager defines contextual access levels (e.g., IP, device security) used by BeyondCorp zero-trust policies. Question 13. Which VPC component can enforce firewall rules based on service-account identity rather than network tags?
Security Engineer Ultimate Exam
Answer: B Explanation: VPC SC creates perimeters around services like Cloud Storage and BigQuery to prevent data from leaving the defined security boundary. Question 16. What must be enabled on a VM without a public IP to allow it to reach Google APIs such as Cloud Storage? A) Cloud NAT B) Private Google Access C) VPC Peering D) Cloud VPN Answer: B Explanation: Private Google Access lets VMs with only internal IPs access Google APIs via Google's internal network. Question 17. Which Google Cloud Armor feature provides protection against SQL injection attacks on HTTP(S) load-balanced applications? A) Rate-based throttling B) Preconfigured WAF rule set C) Adaptive protection D) Bot management Answer: B Explanation: The preconfigured WAF rule set includes signatures for common attacks like SQLi and XSS. Question 18. Cloud IDS is best described as which type of security service?
Security Engineer Ultimate Exam
A) Distributed denial-of-service mitigation B) Managed intrusion detection for VPC traffic C) Web application firewall for Cloud Run D) Identity-aware proxy for SSH Answer: B Explanation: Cloud IDS inspects VPC traffic for known malicious patterns, providing managed intrusion detection. Question 19. To inspect outbound internet traffic from a private subnet, which Google Cloud service should be used? A) Cloud NAT B) Cloud Secure Web Proxy C) Cloud Armor D) VPC Service Controls Answer: B Explanation: Cloud Secure Web Proxy forwards egress traffic to an external proxy for inspection and policy enforcement. Question 20. Packet Mirroring is primarily used for which purpose? A) Load balancing across regions B) Capturing and analyzing live traffic for forensic investigations C) Encrypting traffic between zones D) Automating firewall rule creation Answer: B
Security Engineer Ultimate Exam
B) Compute Engine VMs (SSH/RDP) and App Engine apps C) VPC firewall rules D) Cloud Pub/Sub topics Answer: B Explanation: IAP authenticates users before allowing them to reach web-based applications or remote desktop sessions on VMs that lack public exposure. Question 24. Which DNS feature prevents DNS spoofing by signing DNS responses? A) Private DNS zones B) DNSSEC C) Cloud DNS forwarding D) DNS over HTTPS Answer: B Explanation: DNSSEC adds cryptographic signatures to DNS records, ensuring authenticity of responses. Question 25. Google-managed default encryption uses which type of key for data at rest? A) Customer-managed Cloud KMS key B) Customer-supplied encryption key (CSEK) C) Google-managed key stored in Cloud KMS D) No encryption is applied by default Answer: C
Security Engineer Ultimate Exam
Explanation: By default, Google automatically encrypts data using keys it manages in Cloud KMS without any customer action. Question 26. Which key management option stores encryption keys outside of Google Cloud but still allows Google services to use them? A) Cloud KMS B) Customer-Managed Encryption Keys (CMEK) C) Cloud External Key Manager (EKM) D) Cloud HSM Answer: C Explanation: Cloud EKM integrates with external key management systems, letting Google Cloud call out to keys that reside off-premises. Question 27. For workloads that need FIPS 140-2 Level 3 compliance, which Google service should be used to store encryption keys? A) Cloud KMS Standard B) Cloud HSM C) Cloud KMS with CMEK D) Secret Manager Answer: B Explanation: Cloud HSM provides hardware-based key storage that meets FIPS 140 - 2 Level 3 requirements. Question 28. Which protocol is used by Google’s internal services to provide mutual authentication and encryption beyond TLS? A) HTTP/
Security Engineer Ultimate Exam
Explanation: Cloud DLP provides data discovery and classification capabilities across various data stores. Question 31. Tokenization in the context of data de-identification replaces sensitive data with: A) Encrypted ciphertext that can be reversed with a key B) Randomly generated surrogate values that have no cryptographic relationship to the original data C) Hashed values using SHA- 256 D) Plain-text placeholders Answer: B Explanation: Tokenization substitutes sensitive elements with random tokens that cannot be mathematically reversed, preserving format but removing exposure. Question 32. Which metric does the Sensitive Data Protection (SDP) API use to evaluate the anonymity of a dataset? A) k-anonymity B) SHA-256 hash count C) Data freshness D) Storage latency Answer: A Explanation: k-anonymity measures how many records share the same quasi-identifier values, indicating re-identification risk. Question 33. Secret Manager stores secrets in which Google Cloud region by default?
Security Engineer Ultimate Exam
A) Multi-regional US B) The region of the project’s default location C) The secret’s explicitly specified region D) It stores copies in all enabled regions automatically Answer: C Explanation: When creating a secret, you must specify the region; the secret is stored only in that region unless replicated manually. Question 34. Which audit log type records actions taken by Google personnel on customer data? A) Admin Activity log B) Data Access log C) System Event log D) Access Transparency log Answer: D Explanation: Access Transparency provides logs of Google staff’s accesses to customer content for compliance and visibility. Question 35. VPC Flow Logs are most useful for which of the following tasks? A) Managing IAM permissions B) Analyzing network traffic patterns and detecting anomalies C) Encrypting data at rest D) Deploying container images
Security Engineer Ultimate Exam
A) Reactive incident response B) Threat hunting C) Security orchestration, automation, and response (SOAR) D) Manual patch management Answer: C Explanation: Using Cloud Functions to automatically act on findings implements SOAR, reducing mean-time-to-remediate. Question 39. Binary Authorization in GKE primarily protects against which risk? A) Unauthorized network traffic B) Deployment of container images that have not passed vulnerability scanning or signature verification C) Privilege escalation inside pods D) Data exfiltration from GKE nodes Answer: B Explanation: Binary Authorization enforces that only images signed by trusted authorities can be deployed, preventing malicious containers. Question 40. Which GKE feature provides a lightweight sandbox using gVisor to isolate pod workloads? A) GKE Autopilot B) GKE Sandbox C) Confidential GKE Nodes D) Node-local DNS Cache
Security Engineer Ultimate Exam
Answer: B Explanation: GKE Sandbox runs pods inside gVisor, offering additional isolation from the host kernel. Question 41. Workload Identity in GKE replaces which traditional method of granting pods access to Google Cloud resources? A) Using node-level service-account keys stored on the VM B) Embedding API keys in container images C) Using IAM roles on the project level D) Sharing a single service-account key via a Kubernetes secret Answer: D Explanation: Workload Identity maps a Kubernetes service account to a Google IAM service account, eliminating the need to store long-lived keys in secrets. Question 42. Artifact Registry can enforce which security control at image ingestion time? A) Automatic OS patching of VMs B) Scanning for known vulnerabilities and blocking images that fail policy C) Encrypting images at rest with CMEK only D) Deploying images directly to Cloud Functions Answer: B Explanation: Artifact Registry integrates with Container Analysis to scan images and can enforce policies that reject images with critical vulnerabilities.
Security Engineer Ultimate Exam
Answer: B Explanation: The predefined role roles/aiplatform.modelViewer allows read-only access to models and endpoints, aligning with least-privilege principles. Question 46. To ensure AI training data never leaves the EU, which combination should be used? A) Deploy Vertex AI in a multi-regional location and enable Cloud CDN B) Store data in a multi-regional bucket and use default encryption C) Use a regional bucket in europe-west1 and enable VPC Service Controls with a perimeter that includes Vertex AI services D) Enable Cloud Armor global policy Answer: C Explanation: Placing data in a regional bucket and adding Vertex AI to a VPC SC perimeter enforces geographic residency and prevents data egress. Question 47. In the shared responsibility model, which of the following is Google’s responsibility? A) Encrypting customer data at rest with CMEK B) Physical security of data-center facilities C) Managing IAM policies for a customer’s workloads D) Configuring firewall rules for a VPC Answer: B Explanation: Google secures the underlying infrastructure, including physical data-center security; customers manage logical security controls.
Security Engineer Ultimate Exam
Question 48. Compliance Reports Manager provides access to which type of documentation? A) Real-time security alerts B) Historical audit logs for the past 90 days only C) SOC, ISO, PCI-DSS, and HIPAA compliance reports D) Source code of Google Cloud services Answer: C Explanation: The manager aggregates third-party audit reports and certifications for customer review. Question 49. Which organization policy constraint can be used to prevent the creation of external IP addresses on Compute Engine instances? A) constraints/compute.requireOsLogin B) constraints/compute.vmExternalIpAccess C) constraints/iam.allowedPolicyMemberDomains D) constraints/network.restrictPrivateIpGoogleAccess Answer: B Explanation: constraints/compute.vmExternalIpAccess disables external IP allocation, enforcing private-only networking. Question 50. When a policy denies all egress traffic from a VPC subnet, which Google Cloud service can still allow the subnet to reach Google APIs? A) Private Google Access B) Cloud NAT C) Cloud Router
